# Customer Due Diligence When an AI Agent Runs the Checks > Markdown mirror for AI agents, generated 2026-08-27 from the live page. > Canonical: https://agenticrail.nz/spec/customer-due-diligence/ > Site context: https://agenticrail.nz/llms.txt **Document type** Controls Note — Evidence Brief **Subject** Customer due diligence, beneficial ownership and sanctions screening where an autonomous agent performs the checks and also records that it performed them **Published by** TUARA KURI LIMITED — trading as AgenticRail, Hokianga, Aotearoa New Zealand **Date** 2026-08-26 **Version** 1.0 **Status** Published — open for citation **Related** [Segregation of duties](https://agenticrail.nz/spec/segregation-of-duties/) · [Completeness specification](https://agenticrail.nz/spec/completeness/) · [Provable safeguards](https://agenticrail.nz/spec/enforceable-safeguards/) # Customer Due Diligence When an AI Agent Runs the Checks Anti-money-laundering rules are unusual among control regimes in that they are explicit about **order**. It is not enough that a customer was identified, that the beneficial owner was established, and that sanctions lists were screened. Those things must have happened *before* the business relationship was established. Screening afterwards is not a late check; it is a breach of a timing rule that is written down. This creates a problem for automated onboarding that is sharper than the usual concerns about model reliability: **an agent that performs the checks is also the thing that reports having performed them, in an order it selected itself.** This note sets out what the timing rule actually says, why a log is the wrong shape of evidence for an ordering claim, and what a refused step has to leave behind to count. ## 1. Scope This is a controls note. It is not legal advice, not compliance advice, and not a claim that any product satisfies any regulation. It takes no position on whether customer due diligence should be automated at all. Where a regime is named, it is named as an example of a duty that already exists, cited to its source so the reader can check it. Throughout, one distinction is held: a **record** is something a system writes about itself; **evidence** is a contemporaneous record that a party outside the operating system can verify without trusting that system. The gap described here is in the second, and it is narrower and more specific than the general question of whether AI can be trusted. ## 2. The Control That Predates the Technology Customer due diligence is not a recent invention and it did not arrive with automation. The international standard is set by the Financial Action Task Force, whose Recommendations are the common ancestor of most national anti-money-laundering law [1]. The substance is easier to check in the implementing statute than in the standard, so this note cites the implementing statute throughout. Those requirements are implemented in national law. In the United Kingdom they appear in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 [2], which set out the due diligence measures themselves and require records of them to be kept for **at least five years** running from the end of the business relationship, including records sufficient *"to enable the transaction to be reconstructed"* [3]. In New Zealand they appear in the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 [6]. The vocabulary differs slightly between jurisdictions — customer due diligence, know your customer, know your business, enhanced due diligence — but the shape is the same everywhere the FATF standard has been adopted, which is most places. The control survives because it does not depend on anyone's judgement being good. It is structural and it is ordered. You establish who you are dealing with, and who ultimately controls them, and whether either is subject to sanctions, and only then do you take them on as a customer. Reversing those steps does not produce a slightly worse outcome. It produces the exact outcome the regime exists to prevent. ## 3. The Timing Rule Is the Whole Rule Most control frameworks describe what must be done and leave the sequencing implicit. Anti-money-laundering law does not. Regulation 30(2) of the 2017 Regulations states that a relevant person must comply with the requirement to verify the identity of the customer before the establishment of a business relationship or the carrying out of the transaction [2]. There are exceptions, and they are narrow. Verification may be completed during the establishment of a relationship where that is necessary not to interrupt the normal conduct of business and the risk of money laundering is low. Trust beneficiaries designated by class may be verified before payment rather than at inception [2]. **The most important exception is the one that proves the point rather than weakening it.** Regulation 30(4) permits a credit institution or financial institution to complete verification after an account has been opened — but only where adequate safeguards ensure that no transaction is carried out before verification is complete [2]. Read that as a control requirement rather than as a concession. It obliges the firm to demonstrate a *negative fact about ordering*: that nothing happened before the thing that was supposed to happen first. That is not a claim a log is shaped to support. A log contains entries for things that occurred. The proposition to be established is about something that did **not** occur, and absence leaves no entry. The only way to evidence it is to hold a record produced by something that would have refused the transaction and would have written down the refusal. ## 4. The Failure Shape — the agent checks, and reports on itself Automated onboarding typically decomposes into a sequence like this: search the company register, retrieve officers and beneficial owners, screen against sanctions and insolvency, score the risk, then either onboard or escalate. Handed to an autonomous agent with tool access, each of those becomes a tool call the agent selects and issues. Three properties of that arrangement matter for evidence: - **The agent chooses the order.** A plan expressed in a prompt is an instruction, not a constraint. A model that reorders steps, skips one it judges unnecessary, or retries a failed call in a different position is behaving normally, not malfunctioning. - **The agent writes the record.** The log of what ran is emitted by the same process whose sequencing is in question. It is a record in the sense used in §1, not evidence. - **A skipped step is invisible.** If the sanctions screen never ran, there is no sanctions-screen entry, and nothing else in the log announces the omission. A reviewer sees a shorter list, not a flagged failure — and a shorter list looks identical to a case that legitimately needed fewer checks. The usual mitigations do not close this. A retry or a reordering is not an error condition, so exception reports do not catch it. Post-hoc review of the log inherits the log's authorship problem. Human approval at the end restores accountability for the decision but says nothing about the order of the checks that preceded it, which is the thing the timing rule is about. The result is a firm that has genuinely performed its due diligence, and cannot prove the part the regulation actually specifies. This failure shape is not hypothetical, and the clearest published example is not about artificial intelligence at all. In 2024 the Financial Conduct Authority fined Metro Bank £16,675,200 over automated transaction monitoring that, from June 2016, did not work as intended: an error in how data was fed into the system meant that transactions taking place on the day an account was opened, and any further transactions until the account record was updated, were never monitored. **Over 60 million transactions worth more than £51 billion went unmonitored.** Junior staff raised concerns in 2017 and in 2018 and the issue was not identified. The FCA's finding then names the gap exactly: even after a fix was applied in July 2019, Metro *"did not have a mechanism to consistently check that all relevant transactions were being fed into the monitoring system"* until December 2020, more than four and a half years after the system went live [10]. **Read that as an evidence failure rather than a screening failure.** The control existed. The firm believed it was operating. Nothing in the arrangement was capable of reporting that it was not, because what had gone wrong was an absence, and an absence leaves no entry. The ordering detail is the sharpest part: the transactions that escaped were the ones occurring *before the account record caught up*. A system that had been required to declare its order in advance, and to refuse and record a step taken out of that order, would have produced four and a half years of refusals instead of four and a half years of silence. ## 5. What the Supervisor Actually Asks For The question is narrower than "can you show me your AML process", and it is not answered by a policy document. It is closer to: Show me that for this customer, the identification and screening steps completed before the relationship was established; that this specific case passed through the control rather than around it; and that the record establishing this was not produced by the system whose conduct is in question. That sentence contains four requirements — **coverage** (this case, not a sample), **ordering** (before, not merely present), **non-bypassability** (through the control, not around it), and **independence** (not self-reported). Automated onboarding tooling generally satisfies the first and struggles with the other three, because all three are properties of the thing doing the work rather than properties of what it wrote down. ## 6. Who Already Owes This Duty **United Kingdom.** The 2017 Regulations bind a list of "relevant persons" set out at regulation 8: credit institutions, financial institutions, auditors, insolvency practitioners, external accountants and tax advisers, independent legal professionals, trust or company service providers, estate agents and letting agents, high value dealers, casinos, art market participants, and cryptoasset exchange providers and custodian wallet providers [4]. Where the customer is a company, establishing beneficial ownership means establishing who exercises significant control — in UK terms, the persons with significant control regime in Part 21A of the Companies Act 2006, inserted by the Small Business, Enterprise and Employment Act 2015. Section 790C defines a person with significant control by reference to specified conditions set out in Schedule 1A, which include holding more than 25% of the shares or voting rights, the right to appoint or remove a majority of the board, and the exercise of significant influence or control [5]. On artificial intelligence specifically, the Financial Conduct Authority has been explicit that it is not writing new rules: We do not plan to introduce extra regulations for AI. Instead, we'll rely on existing frameworks, which mitigate many of the risks associated with AI [8]. The frameworks it names are the Consumer Duty and the Senior Managers and Certification Regime, under which accountability for the safe use of AI attaches to a named senior manager [8]. **This is a stronger position for evidence than an AI-specific statute would be, not a weaker one.** A general AI regime would create a new compliance category with its own maturity curve. Existing financial-services accountability already attaches a person's name to the conduct of the firm's systems, and that person cannot delegate the duty to a model or to the vendor of one. **New Zealand.** The AML/CFT Act 2009 imposes equivalent customer due diligence obligations on reporting entities [6]. Supervision changed recently and materially: the Ministry of Justice records that *"on 1 July 2026 the Department of Internal Affairs took over responsibility for supervising and providing guidance to businesses and industries who are required to comply with the AML/CFT Act"* [7]. **Internationally.** Because the FATF Recommendations are the common ancestor, a firm operating across jurisdictions faces the same structural requirement in each, with local variation in thresholds and in which businesses are captured [1]. ## 7. The Instrument, and a Test Anyone Can Run What closes the gap in §5 is not better logging. It is a separate component that holds the declared order, refuses a step attempted out of that order, and produces a signed record of the refusal as well as of the permission — so that the absence of a step becomes a positive artifact rather than a silence. Concretely, a caller declares the sequence in advance, for example `intake → company_search → officers_psc → insolvency_sanctions → risk_decision`. Each step is submitted for a verdict before it runs. A step out of order is denied and the denial is itself signed and chained. The sequence is sealed at its final step, after which it cannot be extended or rewritten without breaking the hash chain. Each receipt is signed with Ed25519 and carries the exact byte string that was signed, so the signature can be verified offline against a published public key, by a party who does not trust the operator and does not call back to it. The claim being made is narrow and worth stating precisely. **A receipt does not establish that a sanctions match was correctly resolved, or that a screening vendor's data was current, or that a risk decision was right.** It establishes that a particular step was permitted at a particular position in a declared order, and that the steps which did not run were refused rather than quietly omitted. That narrows a dispute from "what did your system do" to "was your declared order the right one", which is a smaller and more answerable question. This is testable without an agreement, an account, or a conversation. The public verification endpoint is at [report.agenticrail.nz/report](https://report.agenticrail.nz/report), and the enforcement rules, denial codes and receipt schema are published at [agenticrail.nz/spec/](https://agenticrail.nz/spec/) [11]. ## 8. A Deliberate Boundary — what this does not do - **It performs no screening and holds no data.** No sanctions lists, no company register, no customer records, no beneficial ownership data. If your screening provider is wrong, every receipt will faithfully record that the wrong answer was obtained in the correct order. - **It does not determine who a beneficial owner is.** Resolving control through a chain of holding companies is a judgement, and this is not the tool that makes it. - **The timestamp is signed but self-asserted.** `ts_ms` is supplied by the caller and bounded by a freshness rule that refuses any value more than 300 seconds from the gate's own clock. The signature makes it tamper-evident after the fact; it does not make it independently attested. An RFC 3161 trusted timestamp is the known remedy [9] and is not built. - **Retention is a live constraint, not a footnote.** UK record-keeping requires at least five years from the end of the business relationship [3]. Receipts created on the public demo lane are deleted after thirty days and are world-readable while they exist. Evaluation traffic is fine on that lane; an actual due diligence record is not. - **No certification is claimed.** Not SOC 2, not ISO 27001, not ISO 42001. Nothing on this page asserts that any named regulation is satisfied by using this product. - **Signing keys are held by the operator.** The service is hosted. That is strong on integrity — an altered receipt breaks the chain detectably — and weaker on independence than an arrangement where a third party holds the keys. Sequences are additionally copied at seal time to a separately credentialed, write-once archive, which narrows but does not eliminate that gap. - **It enforces order, not correctness within a step.** The agent still decides what to do inside a step. If your onboarding genuinely has no order worth enforcing, this is not the tool for it. ## 9. References - Financial Action Task Force, *International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation — The FATF Recommendations*. The international standard on customer due diligence and record-keeping, implemented in national law by FATF members. Cited here as the common ancestor of the national instruments below; the operative wording relied on in this note is taken from those instruments, not from the standard. - The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, SI 2017/692 (United Kingdom) — regulation 30, timing of customer due diligence measures; regulation 30(2) on verification before establishment of a business relationship, and regulation 30(4) on the conditional exception for credit and financial institutions. [legislation.gov.uk/uksi/2017/692/regulation/30](https://www.legislation.gov.uk/uksi/2017/692/regulation/30). - Same Regulations, regulation 40 — record-keeping; retention of at least five years running from the end of the business relationship or completion of an occasional transaction, and records sufficient to enable a transaction to be reconstructed. [legislation.gov.uk/uksi/2017/692/regulation/40](https://www.legislation.gov.uk/uksi/2017/692/regulation/40). - Same Regulations, regulation 8 — the "relevant persons" to whom the Regulations apply. [legislation.gov.uk/uksi/2017/692/regulation/8](https://www.legislation.gov.uk/uksi/2017/692/regulation/8). - Companies Act 2006, Part 21A (*Information about people with significant control*), inserted by the Small Business, Enterprise and Employment Act 2015; section 790C defines a person with significant control by reference to the specified conditions in Schedule 1A. [legislation.gov.uk/ukpga/2006/46/part/21A](https://www.legislation.gov.uk/ukpga/2006/46/part/21A). - Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (New Zealand) — customer due diligence obligations on reporting entities. - New Zealand Ministry of Justice, *Tackling money laundering and terrorism financing* — *"On 1 July 2026 the Department of Internal Affairs took over responsibility for supervising and providing guidance to businesses and industries who are required to comply with the AML/CFT Act."* [justice.govt.nz](https://www.justice.govt.nz/justice-sector-policy/key-initiatives/aml-cft/). - Financial Conduct Authority, *AI and the FCA: our approach* — statement that the FCA does not plan to introduce extra regulations for AI, and reliance on the Consumer Duty and the Senior Managers and Certification Regime. [fca.org.uk/firms/innovation/ai-approach](https://www.fca.org.uk/firms/innovation/ai-approach). - IETF RFC 3161, *Internet X.509 Public Key Infrastructure Time-Stamp Protocol* — trusted timestamp tokens from an independent Time Stamping Authority. - Financial Conduct Authority, *FCA fines Metro Bank £16m for financial crime failings* (2024), and the accompanying Final Notice — automated transaction monitoring from June 2016 to December 2020; over 60 million transactions valued at more than £51 billion not monitored; concerns raised by junior staff in 2017 and 2018; no mechanism to check that all relevant transactions were reaching the monitoring system until December 2020. [fca.org.uk](https://www.fca.org.uk/news/press-releases/fca-fines-metro-bank-16m-financial-crime-failings). - AgenticRail enforcement specification and receipt schema — [agenticrail.nz/spec/](https://agenticrail.nz/spec/). Document Fingerprint — SHA-256 — v1.0 85e5c65a90ad8725871c9aa41ca7529905c26ddb0d531188ab7ffc2f64dceaf5 This hash is SHA-256 of the canonical string defined below. It is reproducible independently of this page using any SHA-256 implementation. **Canonical string (pipe-delimited, UTF-8, no trailing newline):** `Customer Due Diligence When an AI Agent Runs the Checks|1.0|2026-08-26|TUARA KURI LIMITED|anti-money-laundering rules are explicit about order not only about occurrence|FATF Recommendations are the common ancestor cited as anchor while operative wording is taken from the implementing statutes|UK MLR 2017 regulation 30(2) verify before the establishment of a business relationship or the carrying out of the transaction|regulation 30(4) exception is conditional on adequate safeguards that no transaction is carried out before verification is complete|the exception obliges proof of a negative fact about ordering which a log is not shaped to support|absence leaves no entry so a skipped screening step is invisible in a self-written record|the agent chooses the order writes the record and a shorter list looks identical to a case needing fewer checks|four requirements coverage ordering non-bypassability independence of the record|regulation 40 records at least five years from the end of the business relationship sufficient to enable the transaction to be reconstructed|regulation 8 relevant persons includes credit and financial institutions auditors insolvency practitioners accountants tax advisers legal professionals trust or company service providers estate and letting agents high value dealers casinos art market participants cryptoasset exchange providers custodian wallet providers|Companies Act 2006 Part 21A section 790C and Schedule 1A more than 25 percent of shares or voting rights|FCA we do not plan to introduce extra regulations for AI instead we will rely on existing frameworks|Senior Managers and Certification Regime attaches accountability for safe AI use to a named senior manager|New Zealand AML CFT Act 2009 and DIA took over supervision on 1 July 2026 per Ministry of Justice|a refused step must be signed and chained so an omission becomes an artifact rather than a silence|receipt narrows the dispute from what did your system do to was your declared order the right one|performs no screening holds no sanctions company or customer data|does not determine who a beneficial owner is|timestamp signed but self-asserted bounded by a 300 second freshness rule RFC 3161 is the known remedy and is not built|five year retention required while demo lane receipts are deleted after thirty days and are world-readable|no SOC 2 no ISO 27001 no ISO 42001 claimed|hosted service signing keys held by operator strong on integrity weaker on independence write-once archive narrows it|enforces order not correctness within a step|FCA fined Metro Bank 16,675,200 for automated transaction monitoring that did not work as intended from June 2016|over 60 million transactions worth more than 51 billion pounds went unmonitored and no mechanism existed to check coverage until December 2020|an evidence failure not a screening failure the escaping transactions were those before the account record caught up|report.agenticrail.nz` Published: 2026-08-26 | Version: 1.0 | Entity: TUARA KURI LIMITED **Sourcing note:** §2 and §6 cite the FATF Recommendations, the UK Money Laundering Regulations 2017, the Companies Act 2006 persons-with-significant-control regime, the FCA's published position on AI, the New Zealand AML/CFT Act 2009 the New Zealand Ministry of Justice record of the 1 July 2026 supervisory transfer, and the FCA's published enforcement finding against Metro Bank. The regulation 30(2) and 30(4) wording in §3 is quoted and paraphrased from the instrument itself and is linked so it can be checked. Naming a duty is not a claim that this product satisfies it. The limits in §8 are stated in full rather than summarised.